Privacy Policy
Last updated: 2026-07-31
1. Data Controller
The controller of the personal data collected through this site is Eat & Fit.
For any question regarding your personal data: contact@example.com.
Remember to replace this address with your actual contact address before going live.
2. Data Collected and Purposes
The personal data collected depends on the features you use. The exhaustive list is in the Subprocessors section below, where each recipient indicates precisely what data they process and for what purpose.
3. Legal Basis for Processing
The processing of your data relies on one of the legal bases set out in Article 6 of the GDPR depending on the context: contract performance, legitimate interest, consent, or legal obligation.
4. Subprocessors and Recipients
To provide this service, we work with third-party subprocessors. Each subprocessor only handles the data strictly required for their task, under a contract compliant with Article 28 of the GDPR.
Vercel Inc.
440 N Barranca Ave #4133, Covina, CA 91723, USA
- Purpose
- Hosting and serverless function execution (Frankfurt region - fra1)
- Data processed
- IP addresses
- Server logs
- Session cookies
- Retention
- 30 days for logs
- Legal basis
- Legitimate interest (Art. 6.1.f GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). Functions run in the EU (Frankfurt) but legal entity is US-based
- More info
- Privacy policyData Processing Agreement (DPA)
Databricks, Inc. (Neon)
160 Spear Street, 13th Floor, San Francisco, CA 94105, USA
- Purpose
- PostgreSQL database hosting
- Data processed
- All application data stored in the database
- Retention
- Account lifetime (deletion on request)
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). Database region configurable (eu-central-1 available)
- More info
- Privacy policyData Processing Agreement (DPA)
Resend Inc.
2261 Market Street #4667, San Francisco, CA 94114, USA
- Purpose
- Transactional email delivery
- Data processed
- Recipient email
- Content of sent emails
- Retention
- 30 days for delivery logs
- Legal basis
- Contract performance / legitimate interest
- Transfer / details
- Standard Contractual Clauses (SCC)
- More info
- Privacy policyData Processing Agreement (DPA)
Stripe Payments Europe, Ltd.
1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Irlande
- Purpose
- Payment and subscription management (card payments, invoices)
- Data processed
- Email address
- Payment data (entered directly with Stripe, never stored by Eat & Fit)
- Billing history
- Retention
- Duration of the business relationship, then legal accounting retention periods (10 years)
- Legal basis
- Performance of a contract (Art. 6.1.b GDPR) and legal obligation (Art. 6.1.c)
- Transfer / details
- EU entity. Any transfers to Stripe, Inc. (USA) are covered by the Data Privacy Framework and Standard Contractual Clauses
- More info
- Privacy policyData Processing Agreement (DPA)
Google Ireland Limited (Google AdSense)
Gordon House, Barrow Street, Dublin 4, Irlande
- Purpose
- Showing ads on the Free and Essential plans, and collecting advertising consent
- Data processed
- IP address
- Advertising cookie identifiers
- Pages viewed and interactions with ads
- Retention
- As per Google's policy (advertising cookies up to 13 months)
- Legal basis
- Consent (Art. 6.1.a GDPR) for personalised ads; legitimate interest for non-personalised ads
- Transfer / details
- EU entity. Any transfers to Google LLC (USA) are covered by the Data Privacy Framework and Standard Contractual Clauses
- More info
- Privacy policyData Processing Agreement (DPA)
Anthropic, PBC
548 Market Street, PMB 90375, San Francisco, CA 94104, USA
- Purpose
- Artificial intelligence (Claude): meal photo analysis and personalised report writing
- Data processed
- Meal photos sent for analysis (not kept by Eat & Fit)
- Questionnaire and tracking data used for the report
- Retention
- Not kept by Eat & Fit; at Anthropic, limited retention under its API commercial terms
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC)
- More info
- Privacy policy
5. Your Rights
Under the GDPR, you have the following rights over your data:
- Right of access and rectification
- Right to erasure (right to be forgotten)
- Right to data portability
- Right to object and to restrict processing
- Right to withdraw your consent at any time (when processing is based on consent)
- Right to lodge a complaint with the CNIL (cnil.fr) or any other competent authority
To exercise your rights: contact@example.com. We commit to responding within a maximum of one month.
6. Cookies
By default, this site only uses cookies strictly necessary for its operation (session, preferences). No advertising or profiling cookie is set without your explicit consent.
The Free and Essential plans show ads provided by Google AdSense. Before any advertising cookie is set, a Google consent message lets you accept, refuse or customise; if you refuse, only non-personalised ads may be shown. You can change your choice at any time from that message. The Premium plan shows no ads and loads no advertising script.
7. Modifications
This policy may be updated to reflect changes to the services and subprocessors used. The last update date is shown at the top of this page. Substantial changes will be notified by email to registered account holders.